Go Standard Library Path/Filepath vulnerabilities
5 vulnerabilities
Known vulnerabilities in Go Standard Library Path/Filepath, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2023-45284go standard library · path/filepath +571 moreIncorrect detection of reserved device names on Windows in path/filepathOn Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.CVSS5.3MediumEPSS1.09%PrioritiseCVE-2023-45283go standard library · internal/safefilepath +578 moreInsecure parsing of Windows paths with a \??\ prefix in path/filepathThe filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.CVSS7.5HighEPSS3.32%PrioritiseCVE-2022-41722go standard library · path/filepath +23 morePath traversal on Windows in path/filepathA path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".CVSS7.5HighEPSS1.68%PrioritiseCVE-2022-30632go standard library · path/filepath +7 moreStack exhaustion on crafted paths in path/filepathUncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.CVSS7.5HighEPSS2.19%PrioritiseCVE-2022-29804go standard library · path/filepath +3 morePath traversal via Clean on Windows in path/filepathIncorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.CVSS7.5HighEPSS2.39%